Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104937

Quick assessment

Affected
Shopware Shopware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Shopware 6.7 版本允许上传攻击者可控的 HTML 文件，并以 text/html 类型提供服务，且缺乏有效的安全头防护，从而导致存储型跨站脚本攻击（Stored XSS）。当管理员查看包含嵌入式 JavaScript 恶意负载的上传文件时，攻击者可以获取并泄露管理员的身份验证令牌（authentication token）。 该被窃取的令牌使得攻击者能够未经授权地访问 Shopware 管理 API。如果受影响的管理员账户具有扩展管理权限，攻击者可以上传、安装并激活恶意插件，从而以 Shopware 进

AI Predicted 9.8 Difficulty: Easy EPSS 0.28% · P19

Affected Version Matrix 1

VendorProduct Version RangeStatus
Shopware Shopware 6.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104937

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CVE-2026-104937
Source: CVE Program / CVE List V5
Vulnerability Description
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token. The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Shopware Shopware 6.7 -

II. Public POCs for CVE-2026-104937

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104937

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104937 (1)

IV. Related Vulnerabilities

Same product: Shopware
Same vendor: Shopware

V. Comments for CVE-2026-104937

No comments yet

Leave a comment